Cloud phone fraud-enablement ecosystem and darknet resale channels
Threat Actor Meta
Summary
Hide ▲
Show ▼
Cloud phone platforms have become a fraud-enablement ecosystem that lets criminals rent realistic mobile devices, abuse pre-verified bank accounts, and move stolen funds through dropper accounts. The shift matters because the same virtual device used for verification can later be resold on darknet markets, making the abuse look like a familiar device login. That raises detection risk for banks and payments teams by weakening traditional device-fingerprinting checks.
Related Happenings
UK Authorized Push Payment fraud losses tied to dropper accounts in 2022
Target Trend
First: 25.03.2026 18:05
Last: 25.03.2026 18:05
Sources 1
How related:
In the UK, losses linked to Authorized Push Payment fraud reached £485.2m ($649m) in 2022, Group-IB said, with dropper accounts identified as a major contributor.
About this happening:
UK **Authorized Push Payment fraud** losses reached **£485.2m ($649m)** in **2022**, and **dropper accounts** were identified as a major contributor, signaling a persistent fraud...
UK Authorized Push Payment fraud losses tied to dropper accounts in 2022
Target TrendHow related: In the UK, losses linked to Authorized Push Payment fraud reached £485.2m ($649m) in 2022, Group-IB said, with dropper accounts identified as a major contributor.
About this happening: UK **Authorized Push Payment fraud** losses reached **£485.2m ($649m)** in **2022**, and **dropper accounts** were identified as a major contributor, signaling a persistent fraud...
GoldFactory Coretax impersonation fraud campaign
Campaign
First: 19.02.2026 17:30
Last: 19.02.2026 17:30
Sources 1
About this happening:
The **GoldFactory**-linked fraud campaign now threatens **Indonesian taxpayers** at scale, with estimated losses of **$1.5m to $2m**. It ran from **July 2025** and intensified in...
GoldFactory Coretax impersonation fraud campaign
CampaignAbout this happening: The **GoldFactory**-linked fraud campaign now threatens **Indonesian taxpayers** at scale, with estimated losses of **$1.5m to $2m**. It ran from **July 2025** and intensified in...
ZeroDayRAT mobile spyware advertisement
Malware Activity
First: 10.02.2026 15:00
Last: 10.02.2026 15:00
Sources 1
About this happening:
The **ZeroDayRAT** mobile spyware platform is being advertised on **Telegram** as a commercial toolkit for **Android** and **iOS** devices, with support for **Android 5 through 16...
ZeroDayRAT mobile spyware advertisement
Malware ActivityAbout this happening: The **ZeroDayRAT** mobile spyware platform is being advertised on **Telegram** as a commercial toolkit for **Android** and **iOS** devices, with support for **Android 5 through 16...
Peru loan phishing campaign impersonating financial institutions across Latin America
Campaign
First: 21.01.2026 17:00
Last: 21.01.2026 17:00
Sources 1
About this happening:
A **Peru-focused loan phishing campaign** has expanded across **Latin America**, putting users' **card numbers**, **PIN codes**, and **banking credentials** at risk. The operation...
Peru loan phishing campaign impersonating financial institutions across Latin America
CampaignAbout this happening: A **Peru-focused loan phishing campaign** has expanded across **Latin America**, putting users' **card numbers**, **PIN codes**, and **banking credentials** at risk. The operation...
WEF Cybercrime Atlas analysis finds deepfake tools can bypass KYC verification
Technical Analysis
First: 09.01.2026 14:15
Last: 09.01.2026 14:15
Sources 1
About this happening:
A **January 8** assessment of **17 face-swapping tools** and **8 camera injection tools** showed that some deepfake systems can defeat **KYC** and remote verification, increasing...
WEF Cybercrime Atlas analysis finds deepfake tools can bypass KYC verification
Technical AnalysisAbout this happening: A **January 8** assessment of **17 face-swapping tools** and **8 camera injection tools** showed that some deepfake systems can defeat **KYC** and remote verification, increasing...
Timeline
-
25.03.2026 18:05 2 articles · 2mo ago
Group-IB disclosure links cloud phones to financial fraud
Initial DisclosureGroup-IB published research on March 25, 2026 showing that cloud phones—remote-access Android devices hosted in data centres—are being abused for financial fraud and for creating and maintaining dropper accounts that receive and transfer stolen funds. The research says these devices can look like legitimate smartphones, making traditional device fingerprinting less effective, and recommends multi-layered fraud detection that combines network intelligence, behavioral modeling and graph-based risk analysis.
Show sources
- Cloud Phones Linked to Rising Financial Fraud Threat — www.infosecurity-magazine.com — 25.03.2026 18:05
- Cloud Phones Linked to Rising Financial Fraud Threat — www.infosecurity-magazine.com — 25.03.2026 18:05